There is something almost poetic about the fact that during Cybersecurity Awareness Month, we learned that for roughly 17 months, part of the trust system that helps the Internet verify the authenticity of websites was protected by a cryptographic key weaker than the password on your luggage.
Most people encounter internet security through the little padlock icon in their web browser, but the same trust system protects much more than websites. Every day, computers, smartphones, home routers, smart TVs, thermostats, security cameras, software updates, and countless other connected devices rely on digital certificates to verify that they are communicating with legitimate systems and not impostors. For example, when you visit your bank’s website, digital certificates help your computer verify that it is communicating with your bank, not with a malicious actor attempting to steal your credentials.
These certificates are issued by trusted organizations known as Certificate Authorities (CAs). Your computer validates a certificate by tracing it back to a trusted authority built into your operating system or browser. Only a few dozen organizations worldwide operate these systems, and because they sit at the foundation of internet trust, the cryptographic keys that protect them are supposed to be virtually impossible to guess. The eMudhra keys were intended to be 384 bits long, giving them more possible values than there are atoms in the observable universe.
That is why the recent incident involving Indian certificate authority eMudhra was so remarkable. According to reports, the private keys for eight of eMudhra’s intermediate certificate authorities were generated incorrectly, resulting in values between 1 and 256. One of the keys was literally the number 4. Researchers were able to recover the keys almost instantly. Anyone in possession of one of those private keys could potentially create fraudulent digital certificates that would appear legitimate to systems that still trusted the affected certificate authorities.
Browser vendors moved quickly. Mozilla received a report of the issue on October 17, 2026, and Chrome and Firefox blocked the affected certificate authorities within hours. eMudhra revoked the certificates and later announced that it would exit the global SSL/TLS certificate business. Although there is no public evidence that the weak keys were exploited, no one knows whether someone independently discovered them during the approximately 17 months they existed.
Here is why this matters to the rest of us. While major browsers were able to protect users remotely, many other devices and applications are not updated as easily. This includes servers, printers, industrial equipment, Internet-of-Things devices, and older software that may need to be manually updated. Some of these systems do not continuously check for certificate revocations, meaning that simply revoking the affected certificates may not protect them. Instead, they require software updates that explicitly remove trust in the compromised certificates, and those updates may need to be installed manually.
The lesson is simple: keep your software up to date. Updates are not just about new features, refreshed designs, or the latest emoji. They frequently contain critical security fixes that protect your devices from newly discovered threats. Sometimes, the fix is for a security system whose secret key turned out to be 4.
This publication is provided by Greenspoon Marder LLP is issued for informational purposes only and is not intended to be construed or used as general legal advice nor a solicitation of any type. Please contact the author(s) or your Greenspoon Marder LLP contact if you have any questions regarding the currency of this information. The hiring of a lawyer is an important decision. Before you decide, ask for written information about the lawyer’s legal qualifications and experience.
